{"id":865,"date":"2026-04-16T11:36:49","date_gmt":"2026-04-16T11:36:49","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-artifact-registry-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/"},"modified":"2026-04-16T11:36:49","modified_gmt":"2026-04-16T11:36:49","slug":"oracle-cloud-artifact-registry-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-artifact-registry-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-compute\/","title":{"rendered":"Oracle Cloud Artifact Registry Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Compute"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Compute<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Artifact Registry<\/strong> is Oracle Cloud Infrastructure (OCI)\u2019s managed service for storing and distributing software artifacts\u2014most commonly <strong>container images<\/strong> used by Compute workloads (VMs, Kubernetes, Functions, CI\/CD runners).<\/p>\n\n\n\n<p><strong>Simple explanation:<\/strong> Artifact Registry is a secure, centralized \u201cwarehouse\u201d for the build outputs your applications need at runtime\u2014so your servers and clusters can reliably pull the right container image or package version whenever they deploy.<\/p>\n\n\n\n<p><strong>Technical explanation:<\/strong> Artifact Registry provides regional, compartment-scoped repositories that support standards-based distribution protocols (for example, Docker Registry HTTP API v2 for container images). It integrates with OCI Identity and Access Management (IAM) for authorization, with OCI Audit for control-plane visibility, and with common OCI compute services such as <strong>Compute<\/strong> instances and <strong>Container Engine for Kubernetes (OKE)<\/strong> for image pulls.<\/p>\n\n\n\n<p><strong>What problem it solves:<\/strong> In modern delivery pipelines, application releases produce artifacts (images, charts, packages) that must be stored, versioned, secured, and delivered quickly to runtime environments. Without a managed registry, teams end up with inconsistent builds, ad-hoc storage, manual access control, slow pulls, and higher operational burden. Artifact Registry addresses these issues with a managed, IAM-integrated registry built for OCI.<\/p>\n\n\n\n<blockquote>\n<p>Naming note (important): OCI historically referred to its container registry as <strong>OCI Registry (OCIR)<\/strong> and still uses the <code>ocir.io<\/code> domain in endpoints. <strong>Artifact Registry<\/strong> is the current service name in OCI Console and documentation. If you see OCIR in older guides, it typically refers to the same family of capabilities. Verify current naming and features in the official docs linked in Section 17.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Artifact Registry?<\/h2>\n\n\n\n<p><strong>Official purpose:<\/strong> Artifact Registry is OCI\u2019s service for hosting and managing software artifacts\u2014especially <strong>container images<\/strong>\u2014so teams can push artifacts from build systems and pull them from runtime environments in a controlled, auditable way.<\/p>\n\n\n\n<p><strong>Core capabilities (commonly used):<\/strong>\n&#8211; Create and manage repositories in OCI compartments\n&#8211; Push and pull <strong>container images<\/strong> using standard Docker\/OCI tooling\n&#8211; Control access with OCI IAM policies\n&#8211; Organize artifacts by repository and tags (and\/or digests)\n&#8211; Integrate artifacts into OCI deployment targets (Compute, OKE, DevOps)<\/p>\n\n\n\n<p><strong>Major components:<\/strong>\n&#8211; <strong>Tenancy namespace<\/strong>: A unique identifier used as part of image names and endpoints (commonly required when tagging images for OCI).\n&#8211; <strong>Repositories<\/strong>: Logical collections of artifacts (for example, a repository per application or per team).\n&#8211; <strong>Artifacts<\/strong>: The stored items (commonly container image manifests\/layers).\n&#8211; <strong>Tags and digests<\/strong>: Human-friendly pointers (tags) and immutable identifiers (digests) used to reference images.<\/p>\n\n\n\n<p><strong>Service type:<\/strong> Managed registry service (control plane via OCI APIs\/Console; data plane via registry endpoints).<\/p>\n\n\n\n<p><strong>Scope and placement:<\/strong>\n&#8211; <strong>Regional service<\/strong>: Repositories exist in a specific OCI region. Your clients push\/pull from the region endpoint (for example, a <code>*.ocir.io<\/code> host).\n&#8211; <strong>Tenancy + compartment-scoped management<\/strong>: Administrative control is governed by IAM policies in compartments within a tenancy.\n&#8211; <strong>Network access<\/strong>: Typically accessed over HTTPS via a public endpoint; private network patterns depend on OCI networking options and service capabilities in your region (verify in official docs).<\/p>\n\n\n\n<p><strong>How it fits into the Oracle Cloud ecosystem (especially Compute):<\/strong>\n&#8211; <strong>Compute instances<\/strong> pull images to run containerized workloads (Docker\/Podman).\n&#8211; <strong>OKE<\/strong> pulls images to schedule containers on Kubernetes nodes.\n&#8211; <strong>OCI DevOps<\/strong> build pipelines push images; deploy pipelines reference them.\n&#8211; <strong>IAM<\/strong> defines who can create repos, push images, and pull images.\n&#8211; <strong>Audit<\/strong> records management actions (for example, repo creation\/deletion). Data-plane logging (image pull\/push events) varies\u2014verify in docs for your exact needs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Artifact Registry?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Faster, repeatable releases:<\/strong> Centralized artifacts reduce \u201cworks on my machine\u201d drift and improve deployment consistency.<\/li>\n<li><strong>Reduced operational overhead:<\/strong> Managed service eliminates running your own registry infrastructure and patching it.<\/li>\n<li><strong>Cleaner governance:<\/strong> Repository organization by compartment supports business unit\/team separation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Standards-based tooling:<\/strong> Works with Docker-compatible clients and common CI systems.<\/li>\n<li><strong>Regional proximity:<\/strong> Hosting artifacts in the same region as runtime Compute reduces pull latency and improves rollout speed.<\/li>\n<li><strong>Immutable references (via digests):<\/strong> Supports safer deployments by pinning exact image digests (where your tooling supports it).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI-native IAM:<\/strong> Use groups, dynamic groups, and policies for consistent access control.<\/li>\n<li><strong>Compartment model:<\/strong> Align repositories with environments (dev\/test\/prod) and teams.<\/li>\n<li><strong>Automation-friendly:<\/strong> Manage repos and images via OCI APIs\/CLI (verify command set in your OCI CLI version).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security \/ compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Least privilege access:<\/strong> Separate who can push vs. who can pull.<\/li>\n<li><strong>Auditability (control plane):<\/strong> Administrative actions can be tracked via OCI Audit.<\/li>\n<li><strong>Encryption-at-rest and TLS-in-transit:<\/strong> OCI services generally encrypt data at rest and use TLS for transport; confirm specifics in Artifact Registry docs for your compliance baseline.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability \/ performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Designed for many pulls:<\/strong> Registries are optimized for distributing images to fleets of nodes.<\/li>\n<li><strong>Supports modern delivery patterns:<\/strong> Blue\/green or canary rollouts involve many concurrent pulls; a registry is the correct distribution primitive.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose Artifact Registry<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You deploy workloads to <strong>OCI Compute<\/strong> or <strong>OKE<\/strong> and need a reliable image source.<\/li>\n<li>You want OCI IAM governance rather than separate credentials per tool.<\/li>\n<li>You want to keep artifacts close to OCI regions to reduce latency and egress.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You are not using OCI for runtime and already standardize on another registry with strong cross-cloud replication (unless you implement a multi-registry strategy).<\/li>\n<li>You require features not confirmed for OCI Artifact Registry in your region (for example, advanced replication policies, native pull-through caching, or specific signing workflows). In those cases, validate capabilities first or use an alternative such as JFrog Artifactory or Harbor.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Artifact Registry used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS and software companies running microservices on Kubernetes<\/li>\n<li>Finance and regulated industries needing compartment-based controls and auditability<\/li>\n<li>Retail\/e-commerce with bursty scaling events requiring rapid image pulls<\/li>\n<li>Telecom and media workloads with frequent deployments and CI\/CD maturity<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering teams building internal developer platforms on OCI<\/li>\n<li>DevOps\/SRE teams standardizing delivery pipelines<\/li>\n<li>Security teams implementing artifact provenance and access controls<\/li>\n<li>Application teams packaging services into containers<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Containerized web APIs and background workers<\/li>\n<li>Batch processing jobs on Compute instances<\/li>\n<li>Kubernetes workloads on OKE (Deployments, CronJobs, Jobs)<\/li>\n<li>Serverless (Functions) image-based deployments (verify current OCI Functions packaging model in your region)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Single-region production with dev\/test compartments<\/li>\n<li>Multi-region DR designs (artifact strategy depends on supported replication approaches\u2014verify)<\/li>\n<li>Microservices with one repo per service<\/li>\n<li>Monorepos with multi-image builds and version tagging<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dev\/test:<\/strong> frequent pushes, many tags, rapid churn; cost and cleanup hygiene matter.<\/li>\n<li><strong>Production:<\/strong> fewer pushes, controlled promotion, strong access controls, digest pinning, and change management.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where Oracle Cloud Artifact Registry fits well.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Central container image store for Compute-based apps<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> VMs run containers, but images are scattered across laptops and ad-hoc servers.<\/li>\n<li><strong>Why it fits:<\/strong> Artifact Registry provides a managed, IAM-controlled registry endpoint.<\/li>\n<li><strong>Example:<\/strong> A team runs 20 OCI Compute instances that pull <code>myapi:1.4.2<\/code> during rollout.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Kubernetes (OKE) cluster image source<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Kubernetes nodes must pull images quickly and securely.<\/li>\n<li><strong>Why it fits:<\/strong> OKE can pull images from OCI\u2019s registry endpoints using standard image references.<\/li>\n<li><strong>Example:<\/strong> A production OKE cluster pulls images from a \u201cprod\u201d compartment repository.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) CI pipeline push target for built images<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> CI builds container images but needs a trusted place to push them.<\/li>\n<li><strong>Why it fits:<\/strong> CI runners can authenticate and push to Artifact Registry; deploy stages pull the same artifact.<\/li>\n<li><strong>Example:<\/strong> OCI DevOps build pipeline pushes <code>orders:2026.04.16.1<\/code> after tests pass.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Environment separation by compartment (dev\/test\/prod)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Developers accidentally deploy dev images to production.<\/li>\n<li><strong>Why it fits:<\/strong> Use separate compartments and IAM policies; prod repos are write-protected.<\/li>\n<li><strong>Example:<\/strong> Only a release automation group can push to the prod repo.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Third-party vendor image distribution inside OCI<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Vendor provides a container image, but you need to host it internally for controlled pulls.<\/li>\n<li><strong>Why it fits:<\/strong> Pull vendor image once, retag, and push into your OCI-controlled repository.<\/li>\n<li><strong>Example:<\/strong> Security scans and approvals happen before pushing <code>vendor\/agent:3.2<\/code>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Rollbacks with immutable image digests<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Tag-based deployments can drift if tags are overwritten.<\/li>\n<li><strong>Why it fits:<\/strong> Deploy by digest (<code>image@sha256:...<\/code>) for deterministic rollback behavior.<\/li>\n<li><strong>Example:<\/strong> A release references the digest used in the previous stable deploy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Multi-team platform registry with standardized naming<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams use inconsistent naming, causing confusion and broken automation.<\/li>\n<li><strong>Why it fits:<\/strong> Define conventions by repo structure and tagging strategy.<\/li>\n<li><strong>Example:<\/strong> <code>ocir.io\/&lt;ns&gt;\/team-app\/service:semver-build<\/code>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Controlled distribution to air-gapped-ish subnets (egress-restricted)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Compute nodes in private subnets cannot reach public registries.<\/li>\n<li><strong>Why it fits:<\/strong> Hosting artifacts in OCI reduces external dependencies; network egress design can be standardized (NAT\/service routing\u2014verify options).<\/li>\n<li><strong>Example:<\/strong> Private OKE nodes pull from OCI endpoints through approved egress paths.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Blue\/green deployments that require fast, parallel pulls<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A rollout doubles the number of nodes pulling images at once.<\/li>\n<li><strong>Why it fits:<\/strong> Registry services are designed for concurrent distribution patterns.<\/li>\n<li><strong>Example:<\/strong> 200 pods pull a new image in minutes during traffic shift.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) \u201cGolden base image\u201d program<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Security team wants standardized base images patched regularly.<\/li>\n<li><strong>Why it fits:<\/strong> Store base images in a controlled repo; app teams inherit from them.<\/li>\n<li><strong>Example:<\/strong> <code>base\/oraclelinux:9-secured-2026w15<\/code> is the approved baseline.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Disaster recovery preparedness for container artifacts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You can recreate infra, but you also need the exact images used in production.<\/li>\n<li><strong>Why it fits:<\/strong> A registry is a source of truth for runtime artifacts (multi-region strategy depends on available replication\/export methods\u2014verify).<\/li>\n<li><strong>Example:<\/strong> DR runbook includes pulling production-tagged images to rebuild services.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Migration from self-hosted registry to OCI-managed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Self-hosted registry maintenance and outages affect deployments.<\/li>\n<li><strong>Why it fits:<\/strong> Move images to Artifact Registry and simplify operations.<\/li>\n<li><strong>Example:<\/strong> Migrate from a VM-hosted Docker registry to OCI repositories, update image references.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<blockquote>\n<p>The exact feature set can vary over time and by OCI region. Use this section as a practical baseline and verify advanced features (replication, retention, scanning, signing) in the official docs before relying on them.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">1) Managed repositories for container images<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Hosts OCI\/Docker container images and serves them to clients.<\/li>\n<li><strong>Why it matters:<\/strong> Containers are the standard packaging unit for modern Compute and Kubernetes workloads.<\/li>\n<li><strong>Practical benefit:<\/strong> No need to run\/patch your own registry servers.<\/li>\n<li><strong>Caveats:<\/strong> Repository types and supported artifact formats can evolve\u2014verify supported formats in your tenancy\/region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Standards-based push\/pull with Docker-compatible tooling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports typical workflows: <code>docker login<\/code>, <code>docker push<\/code>, <code>docker pull<\/code>.<\/li>\n<li><strong>Why it matters:<\/strong> Minimal changes to existing developer and CI practices.<\/li>\n<li><strong>Practical benefit:<\/strong> Easy onboarding for teams used to Docker Hub, ECR, GCR, ACR.<\/li>\n<li><strong>Caveats:<\/strong> Authentication uses OCI constructs (namespace, auth tokens) that differ from other clouds.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Compartment-based organization<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you place repositories into compartments for isolation and governance.<\/li>\n<li><strong>Why it matters:<\/strong> Compartments are OCI\u2019s core boundary for access control and resource organization.<\/li>\n<li><strong>Practical benefit:<\/strong> Clean dev\/test\/prod separation and chargeback.<\/li>\n<li><strong>Caveats:<\/strong> Cross-compartment access requires explicit IAM policies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) IAM policy-based access control<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Controls who can manage repositories and who can read\/pull artifacts.<\/li>\n<li><strong>Why it matters:<\/strong> Artifact access is production access. Pull rights effectively grant code execution capability.<\/li>\n<li><strong>Practical benefit:<\/strong> Enforce least privilege and separation of duties.<\/li>\n<li><strong>Caveats:<\/strong> Precise policy verbs\/resource types should be confirmed in official docs for Artifact Registry.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Tenancy namespace integration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Uses your tenancy\u2019s unique namespace as part of artifact addressing.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents naming collisions and scopes registry identities.<\/li>\n<li><strong>Practical benefit:<\/strong> Clear ownership and stable naming across OCI.<\/li>\n<li><strong>Caveats:<\/strong> Namespace is required in image names; mis-typing it is a common cause of auth failures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Tagging and versioning conventions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you label images with tags (<code>:1.0.3<\/code>, <code>:prod<\/code>, <code>:gitsha-...<\/code>) and reference immutable digests.<\/li>\n<li><strong>Why it matters:<\/strong> Good tag strategy reduces rollback risk and deployment confusion.<\/li>\n<li><strong>Practical benefit:<\/strong> You can implement promotion flows (build tag \u2192 release tag \u2192 prod tag).<\/li>\n<li><strong>Caveats:<\/strong> Tags are mutable by nature; use digests for strict immutability.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) API\/Console\/CLI manageability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Offers multiple management planes (Console UI and API). OCI CLI commonly supports Artifact Registry operations.<\/li>\n<li><strong>Why it matters:<\/strong> Enables automation and Infrastructure as Code patterns.<\/li>\n<li><strong>Practical benefit:<\/strong> Script repo creation, cleanup jobs, and CI bootstrap.<\/li>\n<li><strong>Caveats:<\/strong> Verify the exact OCI CLI command group for your installed CLI version (for example, run <code>oci --help<\/code> and search for \u201cartifacts\u201d \/ \u201cregistry\u201d).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Integration with OCI DevOps (common pattern)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> CI builds push images; CD deploys workloads that pull those images.<\/li>\n<li><strong>Why it matters:<\/strong> Registry becomes the bridge between build and runtime.<\/li>\n<li><strong>Practical benefit:<\/strong> Clear promotion model; fewer \u201cartifact lost\u201d issues.<\/li>\n<li><strong>Caveats:<\/strong> Exact integration steps depend on DevOps pipeline type and auth model\u2014verify in DevOps docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Auditing via OCI Audit (control plane)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Records management operations (create\/update\/delete repo, policy changes, etc.) in OCI Audit.<\/li>\n<li><strong>Why it matters:<\/strong> Supports governance and incident investigations.<\/li>\n<li><strong>Practical benefit:<\/strong> You can track \u201cwho changed repo settings and when.\u201d<\/li>\n<li><strong>Caveats:<\/strong> Data-plane events (every pull\/push) may not be fully captured; validate logging requirements early.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture<\/h3>\n\n\n\n<p>Artifact Registry sits between:\n&#8211; <strong>Producers<\/strong> (developers, CI build agents) that push artifacts, and\n&#8211; <strong>Consumers<\/strong> (Compute instances, OKE nodes, deployment systems) that pull artifacts.<\/p>\n\n\n\n<p>The registry control plane is managed through OCI (Console\/API), while the data plane uses the registry endpoint over HTTPS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (typical)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Admin<\/strong> creates a repository in a compartment (Console\/API).<\/li>\n<li><strong>IAM policy<\/strong> grants push\/pull permissions to a group or dynamic group.<\/li>\n<li><strong>CI or developer workstation<\/strong> authenticates and pushes an image to the regional endpoint.<\/li>\n<li><strong>Runtime<\/strong> (Compute\/OKE) authenticates and pulls the image by tag or digest.<\/li>\n<li><strong>Deployments<\/strong> run the image; rollouts reference tags\/digests.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related OCI services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Compute<\/strong>: pull\/run images on VMs<\/li>\n<li><strong>OKE<\/strong>: image pulls for pods<\/li>\n<li><strong>OCI DevOps<\/strong>: build and deploy pipelines referencing registry artifacts<\/li>\n<li><strong>IAM<\/strong>: groups, dynamic groups, policies<\/li>\n<li><strong>Vault<\/strong>: store secrets (for example, registry auth tokens) used by CI systems<\/li>\n<li><strong>Audit<\/strong>: track administrative operations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (conceptual)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI IAM<\/strong> for authorization<\/li>\n<li><strong>OCI networking<\/strong> for connectivity to endpoints (VCN egress for private subnets)<\/li>\n<li><strong>OCI compartments<\/strong> for governance boundaries<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model (common patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Human users<\/strong> often authenticate to the registry with an <strong>auth token<\/strong> generated in OCI (rather than using the console password). Docker then stores the token locally.<\/li>\n<li><strong>Automation<\/strong> (CI\/CD) also typically uses auth tokens stored in a secret manager (Vault or a CI secret store).<\/li>\n<li><strong>Workloads<\/strong> (Compute\/OKE) generally use image pull secrets or node-level credentials depending on orchestration approach.<\/li>\n<\/ul>\n\n\n\n<blockquote>\n<p>Verify the recommended authentication method for your exact OCI setup (native IAM users vs federated identities) in the official docs, because username formats can differ.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Artifact Registry is accessed over <strong>HTTPS<\/strong> using a region-specific host (commonly <code>REGIONKEY.ocir.io<\/code>).<\/li>\n<li>Compute resources in private subnets need an outbound path to reach the registry endpoint (commonly via NAT gateway). Whether a Service Gateway\/private routing is supported for Artifact Registry depends on OCI service endpoint design\u2014verify in official networking docs and Artifact Registry docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Audit<\/strong>: monitor control-plane actions and policy changes.<\/li>\n<li><strong>Tagging<\/strong>: use OCI resource tags on repositories for cost allocation.<\/li>\n<li><strong>Quotas\/service limits<\/strong>: define\/monitor repository and storage usage; validate rate\/size limits for large images.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Dev[Developer \/ CI Runner] --&gt;|docker push (HTTPS)| AR[OCI Artifact Registry&lt;br\/&gt;Regional Endpoint]\n  AR --&gt;|docker pull (HTTPS)| VM[OCI Compute Instance]\n  VM --&gt; App[Running Container Workload]\n  IAM[OCI IAM Policies] -. authorizes .- Dev\n  IAM -. authorizes .- VM\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph CICD[CI\/CD]\n    Git[Source Repo] --&gt; Build[Build Pipeline&lt;br\/&gt;tests + docker build]\n    Build --&gt;|push image| AR[OCI Artifact Registry&lt;br\/&gt;Prod Region]\n  end\n\n  subgraph OCI[Oracle Cloud (OCI)]\n    IAM[OCI IAM&lt;br\/&gt;Groups\/Dynamic Groups\/Policies]\n    Vault[OCI Vault&lt;br\/&gt;Secrets (auth token)]\n    Audit[OCI Audit]\n    VCN[VCN]\n    NAT[NAT Gateway \/ Egress Path]\n    OKE[OKE Cluster&lt;br\/&gt;Worker Nodes in Private Subnets]\n    Deploy[Deploy Pipeline&lt;br\/&gt;or GitOps Controller]\n  end\n\n  Vault --&gt; Build\n  IAM -.authz.- Build\n  IAM -.authz.- Deploy\n  Audit -.logs.- AR\n\n  Deploy --&gt; OKE\n  OKE --&gt;|pull image via egress| NAT --&gt; AR\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/tenancy requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud<\/strong> tenancy with permissions to use Artifact Registry in at least one region.<\/li>\n<li>A compartment to hold your repository (or permission to create one).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You need permissions to:\n&#8211; Create\/manage Artifact Registry repositories in a compartment\n&#8211; Read\/pull artifacts (for runtime validation)\n&#8211; Create <strong>auth tokens<\/strong> for a user (for Docker login)<\/p>\n\n\n\n<p>In many organizations, these are covered by an admin role. If you are not an admin, ask your OCI administrator to grant the minimum required permissions for Artifact Registry. <strong>Verify the exact IAM policy syntax<\/strong> for Artifact Registry in official docs, because policy verbs\/resource types must match OCI\u2019s authorization model.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Artifact storage and data transfer may incur charges depending on your usage and Free Tier allowances (see Section 9).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Docker<\/strong> (or Podman with Docker-compatible workflow) on your local machine<\/li>\n<li>Optional: <strong>OCI CLI<\/strong> for automation (verify your CLI supports Artifact Registry commands)<\/li>\n<li>Optional: SSH client if you will validate from an OCI Compute instance<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Artifact Registry is region-based. Choose a region where your tenancy is subscribed and where you run Compute\/OKE.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Repository count limits, storage limits, and request limits can apply.<\/li>\n<li>Check <strong>Service Limits<\/strong> in OCI Console and the Artifact Registry docs for current quotas.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services (for the lab)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Compute<\/strong> (to validate pulling and running the container on a VM)<\/li>\n<li><strong>VCN<\/strong> networking to access the VM via SSH (public IP for simplest lab)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>Artifact Registry costs are typically driven by <strong>storage<\/strong> and <strong>network egress<\/strong>, plus any related costs from build and runtime environments.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (model overview)<\/h3>\n\n\n\n<p>Common pricing factors include:\n&#8211; <strong>Stored data (GB-month):<\/strong> Container image layers and manifests stored in the registry.\n&#8211; <strong>Data transfer out (egress):<\/strong> Pulling images out of a region or out to the public internet can incur egress charges depending on OCI networking rules and destination.\n&#8211; <strong>Requests\/operations:<\/strong> Some registries price by API operations; OCI\u2019s exact model must be confirmed on the official pricing page for Artifact Registry\/Registry.<\/p>\n\n\n\n<p>Because OCI pricing can vary by region and may be updated, <strong>do not rely on third-party numbers<\/strong>. Always confirm with Oracle\u2019s official sources:\n&#8211; OCI pricing pages: https:\/\/www.oracle.com\/cloud\/price-list\/\n&#8211; OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<br\/>\n&#8211; OCI Pricing documentation (if provided per service in your region): verify in official docs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Free Tier (if applicable)<\/h3>\n\n\n\n<p>Oracle Cloud has an Always Free and Free Trial program. Whether Artifact Registry storage\/egress is included or discounted depends on current Free Tier terms. <strong>Verify Free Tier coverage<\/strong> for Artifact Registry and related services in your account.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Primary cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Image size<\/strong>: Large base images (language runtimes, ML stacks) amplify storage and pull costs.<\/li>\n<li><strong>Number of tags\/versions kept<\/strong>: Keeping every build forever increases storage steadily.<\/li>\n<li><strong>Pull frequency<\/strong>: Auto-scaling clusters pull images repeatedly unless nodes cache them.<\/li>\n<li><strong>Cross-region pulls<\/strong>: Pulling from a different region can add latency and potential inter-region data transfer costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Compute build minutes<\/strong>: CI builds running on Compute instances or DevOps build runners cost money.<\/li>\n<li><strong>OKE node egress<\/strong>: Private nodes pulling images may require NAT gateway usage; NAT itself has costs and egress charges may apply.<\/li>\n<li><strong>Backup\/DR strategy<\/strong>: If you export images for DR (for example, to Object Storage), that adds storage and transfer costs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pulling images <strong>within the same region<\/strong> where the workloads run is typically the most cost-efficient and performant pattern.<\/li>\n<li>Pulling images to on-prem or another cloud can create internet egress charges.<\/li>\n<li>If you run private subnets, egress architecture (NAT\/service routing) impacts cost.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Keep images small: multi-stage builds, minimal base images.<\/li>\n<li>Limit tag retention: remove old CI tags; keep only releases.<\/li>\n<li>Prefer same-region artifact placement as runtime.<\/li>\n<li>Avoid needless repulls: use node-level caching and stable tags\/digests; avoid <code>:latest<\/code> in production.<\/li>\n<li>Promote images by retagging release candidates rather than rebuilding identical layers repeatedly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated prices)<\/h3>\n\n\n\n<p>A realistic starter monthly footprint might look like:\n&#8211; 5 services \u00d7 2 images each \u00d7 300 MB per image average \u2248 3 GB stored\n&#8211; 10 pulls per day per service in dev\/test \u2248 moderate data transfer<\/p>\n\n\n\n<p>Cost will be:\n&#8211; <code>storage_GB_month \u00d7 storage_rate<\/code> + <code>egress_GB \u00d7 egress_rate<\/code> (if applicable)<\/p>\n\n\n\n<p>Use the OCI Cost Estimator to plug your region and expected GB-month and egress.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production:\n&#8211; 50\u2013200 nodes pulling images during deployments can create bursty data transfer.\n&#8211; Retaining 6\u201312 months of releases can build significant GB-month usage.\n&#8211; Multi-region strategies can multiply storage if you keep copies per region.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create an <strong>Artifact Registry<\/strong> repository in Oracle Cloud, push a Docker image from your laptop, then pull and run that image on an <strong>OCI Compute<\/strong> instance.<\/p>\n\n\n\n<p>This lab is designed to be:\n&#8211; Beginner-friendly\n&#8211; Low-cost (uses small images and a single VM)\n&#8211; Realistic (mirrors common CI\/CD workflows)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Identify your tenancy\u2019s <strong>namespace<\/strong> and registry endpoint.\n2. Create an Artifact Registry repository.\n3. Generate an auth token and log in to the registry using Docker.\n4. Build a small container image and push it to Artifact Registry.\n5. Provision a Compute VM, pull the image, and run the container.\n6. Validate and clean up.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Choose region, compartment, and find your registry namespace<\/h3>\n\n\n\n<p><strong>Actions (OCI Console):<\/strong>\n1. Sign in to Oracle Cloud Console.\n2. Select the <strong>region<\/strong> you will use (top-right region selector).\n3. Go to <strong>Developer Services \u2192 Artifact Registry<\/strong> (service name may appear under Developer Services).\n4. Find the <strong>Namespace<\/strong> value (often shown in the Artifact Registry\/Registry settings area).<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; You have the tenancy namespace string (you will use it in the image name).\n&#8211; You know your region key (example format: <code>iad<\/code>, <code>fra<\/code>, <code>lhr<\/code>), which is typically part of the registry endpoint.<\/p>\n\n\n\n<p><strong>Notes:<\/strong>\n&#8211; OCI registry endpoints commonly look like:<br\/>\n<code>REGIONKEY.ocir.io<\/code><br\/>\n  The image name commonly includes:<br\/>\n<code>REGIONKEY.ocir.io\/NAMESPACE\/REPOSITORY\/IMAGE:TAG<\/code><\/p>\n\n\n\n<p>Because endpoint formats can change or differ by realm, <strong>verify the exact endpoint shown in the OCI Console<\/strong> for Artifact Registry.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create an Artifact Registry repository<\/h3>\n\n\n\n<p><strong>Actions (OCI Console):<\/strong>\n1. Go to <strong>Developer Services \u2192 Artifact Registry<\/strong>.\n2. Select your target <strong>compartment<\/strong> (left-side compartment selector).\n3. Click <strong>Create repository<\/strong>.\n4. Choose the repository format\/type appropriate for <strong>container images<\/strong>.\n5. Name the repository (example): <code>hello-repo<\/code>\n6. Create it.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; A repository named <code>hello-repo<\/code> exists in your compartment.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can see the repository in the Artifact Registry repository list.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create an auth token for Docker login<\/h3>\n\n\n\n<p>OCI commonly uses <strong>auth tokens<\/strong> for registry access from Docker\/CI.<\/p>\n\n\n\n<p><strong>Actions (OCI Console):<\/strong>\n1. Go to <strong>Identity &amp; Security \u2192 Users<\/strong>.\n2. Select your user.\n3. Find <strong>Auth Tokens<\/strong> and click <strong>Generate Token<\/strong>.\n4. Give it a description (example: <code>docker-login-lab<\/code>).\n5. Copy the token value immediately and store it securely (you won\u2019t be able to view it again).<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; You have an auth token string saved securely for the next steps.<\/p>\n\n\n\n<p><strong>Security tip:<\/strong> Treat the auth token like a password. Don\u2019t paste it into chat logs or commit it to Git.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Log in to Artifact Registry from your local machine<\/h3>\n\n\n\n<p>You will now use Docker to authenticate to the OCI registry endpoint.<\/p>\n\n\n\n<p><strong>Identify these values:<\/strong>\n&#8211; <code>REGIONKEY<\/code>: for example <code>iad<\/code> (use your actual region key)\n&#8211; <code>NAMESPACE<\/code>: your tenancy namespace\n&#8211; <code>USERNAME<\/code>: your OCI username.<br\/>\n  For federated identities, the username format may differ (for example, it may include an identity provider prefix). <strong>Verify the required username format in the official Artifact Registry docs<\/strong> for your identity type.<\/p>\n\n\n\n<p><strong>Command:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">export REGIONKEY=\"your-region-key\"\nexport NAMESPACE=\"your-namespace\"\nexport USERNAME=\"your-oci-username\"\n\ndocker logout \"${REGIONKEY}.ocir.io\" || true\ndocker login \"${REGIONKEY}.ocir.io\" -u \"${NAMESPACE}\/${USERNAME}\"\n<\/code><\/pre>\n\n\n\n<p>When prompted for a password, paste the <strong>auth token<\/strong>.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Docker reports <code>Login Succeeded<\/code>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker system info | grep -i -A2 \"Registry\"\n<\/code><\/pre>\n\n\n\n<p>And\/or check <code>~\/.docker\/config.json<\/code> for an auth entry (do not share it).<\/p>\n\n\n\n<p><strong>Common error: <code>unauthorized: authentication required<\/code><\/strong>\n&#8211; Re-check region endpoint (<code>REGIONKEY.ocir.io<\/code>)\n&#8211; Re-check namespace and username format\n&#8211; Ensure you pasted the auth token (not your console password)\n&#8211; Confirm your user\/group has permission to push\/pull (IAM policy)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Build a small Docker image locally<\/h3>\n\n\n\n<p>Create a new folder and add a tiny web server container.<\/p>\n\n\n\n<p><strong>Commands:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">mkdir -p artifact-registry-lab &amp;&amp; cd artifact-registry-lab\ncat &gt; app.py &lt;&lt;'EOF'\nfrom http.server import BaseHTTPRequestHandler, HTTPServer\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-type\", \"text\/plain; charset=utf-8\")\n        self.end_headers()\n        self.wfile.write(b\"Hello from OCI Artifact Registry on Oracle Cloud Compute!\\n\")\n\nHTTPServer((\"0.0.0.0\", 8080), Handler).serve_forever()\nEOF\n\ncat &gt; Dockerfile &lt;&lt;'EOF'\nFROM python:3.12-slim\nWORKDIR \/app\nCOPY app.py \/app\/app.py\nEXPOSE 8080\nCMD [\"python\", \"\/app\/app.py\"]\nEOF\n\ndocker build -t hello-artifact:1.0 .\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Docker successfully builds the image <code>hello-artifact:1.0<\/code>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker images | grep hello-artifact\ndocker run --rm -p 8080:8080 hello-artifact:1.0\n<\/code><\/pre>\n\n\n\n<p>In a second terminal:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -s http:\/\/localhost:8080\n<\/code><\/pre>\n\n\n\n<p>Stop the container with <code>Ctrl+C<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Tag and push the image to Artifact Registry<\/h3>\n\n\n\n<p>Construct your full image name. A common pattern is:<\/p>\n\n\n\n<p><code>REGIONKEY.ocir.io\/NAMESPACE\/REPO\/IMAGE:TAG<\/code><\/p>\n\n\n\n<p>Example (yours will differ):\n&#8211; <code>iad.ocir.io\/mytenancyns\/hello-repo\/hello-artifact:1.0<\/code><\/p>\n\n\n\n<p><strong>Commands:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">export REPO=\"hello-repo\"\nexport IMAGE=\"hello-artifact\"\nexport TAG=\"1.0\"\n\nexport FULL_IMAGE=\"${REGIONKEY}.ocir.io\/${NAMESPACE}\/${REPO}\/${IMAGE}:${TAG}\"\n\ndocker tag hello-artifact:1.0 \"${FULL_IMAGE}\"\ndocker push \"${FULL_IMAGE}\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Docker outputs layer upload progress and finishes with a digest line.<\/p>\n\n\n\n<p><strong>Verification (OCI Console):<\/strong>\n&#8211; Go to <strong>Artifact Registry \u2192 Repositories \u2192 hello-repo<\/strong>\n&#8211; Confirm the image\/tag appears.<\/p>\n\n\n\n<p><strong>Common error: <code>denied: requested access to the resource is denied<\/code><\/strong>\n&#8211; Repository path mismatch (wrong repo name in the image reference)\n&#8211; IAM policy does not allow pushing\n&#8211; Wrong namespace\/username\/token<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Create a small OCI Compute instance for validation<\/h3>\n\n\n\n<p>For a minimal-cost validation:\n&#8211; Use an Always Free\u2013eligible shape if available in your region (availability varies\u2014verify in console).\n&#8211; Use Oracle Linux (common default).<\/p>\n\n\n\n<p><strong>Actions (OCI Console):<\/strong>\n1. Go to <strong>Compute \u2192 Instances \u2192 Create instance<\/strong>\n2. Choose:\n   &#8211; Name: <code>artifact-registry-vm<\/code>\n   &#8211; Image: Oracle Linux (current supported version)\n   &#8211; Shape: small shape (Always Free if available)\n3. Networking:\n   &#8211; Create\/choose a VCN and subnet\n   &#8211; Assign a public IPv4 address (simplest for a lab)\n4. Add your SSH public key\n5. Create<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; Instance is running and has a public IP.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; SSH to the instance:<\/p>\n\n\n\n<pre><code class=\"language-bash\">ssh -i \/path\/to\/private_key opc@PUBLIC_IP\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Install Docker (or Podman) on the VM<\/h3>\n\n\n\n<p>Oracle Linux commonly supports Podman by default; Docker may require extra steps. Choose one approach that is supported for your OS version.<\/p>\n\n\n\n<p><strong>Option A (Podman):<\/strong> (often easiest on modern Oracle Linux)<\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo dnf -y install podman\npodman --version\n<\/code><\/pre>\n\n\n\n<p><strong>Option B (Docker):<\/strong>\nFollow the current Oracle Linux + Docker installation instructions for your OS version. Because package availability changes, <strong>verify in official Oracle Linux docs<\/strong>.<\/p>\n\n\n\n<p>For the remainder of the lab, we\u2019ll show Docker commands. If you use Podman, many commands are the same (<code>podman login<\/code>, <code>podman pull<\/code>, <code>podman run<\/code>).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Log in from the VM and pull the image<\/h3>\n\n\n\n<p>On the VM, authenticate to the registry.<\/p>\n\n\n\n<p><strong>Command (Docker):<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">export REGIONKEY=\"your-region-key\"\nexport NAMESPACE=\"your-namespace\"\nexport USERNAME=\"your-oci-username\"\nexport FULL_IMAGE=\"${REGIONKEY}.ocir.io\/${NAMESPACE}\/hello-repo\/hello-artifact:1.0\"\n\ndocker login \"${REGIONKEY}.ocir.io\" -u \"${NAMESPACE}\/${USERNAME}\"\ndocker pull \"${FULL_IMAGE}\"\n<\/code><\/pre>\n\n\n\n<p>Paste the same <strong>auth token<\/strong> as the password.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; The image pulls successfully.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker images | grep hello-artifact\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 10: Run the container and validate it<\/h3>\n\n\n\n<p>Run the container on port 8080 and confirm it responds.<\/p>\n\n\n\n<p><strong>Commands (on the VM):<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker run -d --name hello-oci -p 8080:8080 \"${FULL_IMAGE}\"\ndocker ps | grep hello-oci\ncurl -s http:\/\/localhost:8080\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong>\n&#8211; <code>curl<\/code> prints:<br\/>\n<code>Hello from OCI Artifact Registry on Oracle Cloud Compute!<\/code><\/p>\n\n\n\n<p>To test from your laptop, open the instance\u2019s <strong>security list \/ NSG<\/strong> to allow inbound TCP 8080 from your IP, then:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -s http:\/\/PUBLIC_IP:8080\n<\/code><\/pre>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker logs hello-oci --tail 20\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>You have successfully validated:\n&#8211; Repository creation in Oracle Cloud Artifact Registry\n&#8211; Docker authentication using OCI auth token\n&#8211; Image push from local workstation\n&#8211; Image pull and run on OCI Compute<\/p>\n\n\n\n<p>Checklist:\n&#8211; [ ] Image tag visible in the OCI Console repository\n&#8211; [ ] <code>docker push<\/code> completes without permission errors\n&#8211; [ ] VM can <code>docker pull<\/code> the same image\n&#8211; [ ] Container responds on <code>http:\/\/localhost:8080<\/code> (and optionally via public IP)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p><strong>1) Docker login fails<\/strong>\n&#8211; Confirm endpoint: <code>REGIONKEY.ocir.io<\/code>\n&#8211; Confirm username format: <code>NAMESPACE\/USERNAME<\/code> (federated users may differ; verify)\n&#8211; Use <strong>auth token<\/strong> (not console password)\n&#8211; Ensure IAM policies allow access<\/p>\n\n\n\n<p><strong>2) Push denied<\/strong>\n&#8211; Ensure repository exists and name matches exactly\n&#8211; Ensure your user\/group can push\/manage artifacts in that compartment\n&#8211; Ensure you are pushing to the correct region endpoint<\/p>\n\n\n\n<p><strong>3) VM cannot pull (timeout)<\/strong>\n&#8211; If VM is in private subnet, ensure it has egress (NAT gateway + route rules)\n&#8211; Check DNS resolution on VM\n&#8211; Verify security rules allow outbound HTTPS<\/p>\n\n\n\n<p><strong>4) Container runs but not reachable from laptop<\/strong>\n&#8211; Open inbound TCP 8080 in NSG\/security list for your source IP\n&#8211; Confirm firewall on the VM (Oracle Linux firewall rules)\n&#8211; Confirm <code>docker run -p 8080:8080<\/code> published the port<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing costs:\n1. <strong>Stop and remove container on VM<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">docker rm -f hello-oci || true\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"2\">\n<li><strong>Optionally remove the image<\/strong><\/li>\n<\/ol>\n\n\n\n<pre><code class=\"language-bash\">docker rmi \"${FULL_IMAGE}\" || true\n<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"3\">\n<li>\n<p><strong>Terminate the Compute instance<\/strong>\n&#8211; OCI Console \u2192 Compute \u2192 Instances \u2192 <code>artifact-registry-vm<\/code> \u2192 <strong>Terminate<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Delete the repository\/images<\/strong>\n&#8211; Artifact Registry \u2192 repository \u2192 delete images\/tags as needed, then delete repository<\/p>\n<\/li>\n<li>\n<p><strong>Revoke auth token<\/strong>\n&#8211; Identity &amp; Security \u2192 Users \u2192 your user \u2192 Auth Tokens \u2192 delete the token<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Keep artifacts in the same region as runtime<\/strong> to reduce latency and egress.<\/li>\n<li><strong>Use separate compartments<\/strong> for dev\/test\/prod repositories to reduce blast radius.<\/li>\n<li><strong>Reference production deployments by digest<\/strong> where possible for immutability.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Separate push and pull permissions<\/strong>:<\/li>\n<li>CI\/build systems: push (write)<\/li>\n<li>Runtime (OKE\/Compute): pull (read)<\/li>\n<li><strong>Use least privilege<\/strong> policies per compartment.<\/li>\n<li><strong>Avoid sharing human auth tokens<\/strong>; use dedicated CI users or automation identities where possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Implement retention hygiene<\/strong>: delete old CI tags and unused images.<\/li>\n<li><strong>Optimize image size<\/strong>: slim bases, multi-stage builds, reduce layers.<\/li>\n<li><strong>Avoid cross-region pulls<\/strong> unless required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use stable base layers<\/strong> to maximize layer caching on nodes.<\/li>\n<li><strong>Avoid <code>latest<\/code><\/strong> for anything beyond local dev.<\/li>\n<li><strong>Batch rollouts<\/strong> to prevent unnecessary repeated pulls in short windows (depends on your orchestrator).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Treat the registry as production infrastructure<\/strong>:<\/li>\n<li>Define ownership<\/li>\n<li>Document restore\/migration approach (export images if needed\u2014verify recommended method)<\/li>\n<li><strong>Plan for DR<\/strong>: decide whether you rebuild images from source or maintain artifact copies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Tag repositories<\/strong> with cost center, environment, owner.<\/li>\n<li><strong>Monitor storage growth<\/strong> and enforce cleanup policies via automation.<\/li>\n<li><strong>Use Audit logs<\/strong> for governance and incident response.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Repository naming:<\/li>\n<li><code>team-app-service<\/code> or <code>org\/team\/service<\/code><\/li>\n<li>Image tags:<\/li>\n<li><code>semver<\/code> for releases (e.g., <code>1.8.0<\/code>)<\/li>\n<li><code>gitsha-&lt;shortsha&gt;<\/code> for traceability<\/li>\n<li><code>build-&lt;buildnumber&gt;<\/code> for CI<\/li>\n<li>OCI tags on repos:<\/li>\n<li><code>Environment=prod<\/code><\/li>\n<li><code>Owner=platform-team<\/code><\/li>\n<li><code>CostCenter=...<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI IAM controls management and access to Artifact Registry resources through policies.<\/li>\n<li>Docker clients commonly authenticate using <strong>auth tokens<\/strong> associated with users.<\/li>\n<li>In Kubernetes, use image pull secrets and scope them carefully.<\/li>\n<\/ul>\n\n\n\n<p><strong>Key security principle:<\/strong> If an identity can <strong>push<\/strong> to a repo used by production, it can effectively introduce code that runs in production. Treat push permission as highly sensitive.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI services typically encrypt data at rest and use TLS for in-transit encryption.<\/li>\n<li>Confirm Artifact Registry\u2019s encryption posture and any customer-managed key options (if needed) in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Registry endpoints are accessed via HTTPS.<\/li>\n<li>Control egress from private subnets (NAT\/service routing as applicable).<\/li>\n<li>Restrict inbound access to workloads; don\u2019t expose test containers to the internet unnecessarily.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Store auth tokens in <strong>OCI Vault<\/strong> or your CI secret store.<\/li>\n<li>Rotate tokens regularly and immediately on suspected compromise.<\/li>\n<li>Avoid embedding tokens into VM images or container images.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable and retain <strong>OCI Audit<\/strong> logs per your governance policy.<\/li>\n<li>Track:<\/li>\n<li>Repo creation\/deletion<\/li>\n<li>IAM policy changes<\/li>\n<li>Token creation\/deletion processes (token events visibility may vary\u2014verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you have compliance needs (SOC 2, ISO, PCI, HIPAA), confirm:<\/li>\n<li>Data residency (region-specific)<\/li>\n<li>Access logging detail<\/li>\n<li>Retention controls<\/li>\n<li>Encryption key management options<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using one shared \u201cregistry password\u201d across teams<\/li>\n<li>Allowing broad push access to prod repos<\/li>\n<li>Deploying with mutable tags only (risk of tag overwrite)<\/li>\n<li>Leaving old auth tokens active indefinitely<\/li>\n<li>Pulling images directly from public registries in production without vetting<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use dev\/test repos for experimentation; promote to prod repos via controlled pipeline.<\/li>\n<li>Use digest pinning for production rollouts.<\/li>\n<li>Restrict who can create\/delete repos and who can push to prod.<\/li>\n<li>Consider integrating image scanning and provenance workflows if available in your environment (verify OCI services and integrations).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<blockquote>\n<p>Validate current limits and supported features in official docs; registries evolve quickly.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations \/ common gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Region specificity:<\/strong> Repositories are tied to a region. Pulling across regions can add latency and may incur transfer costs.<\/li>\n<li><strong>Namespace confusion:<\/strong> Misunderstanding the tenancy namespace is a top cause of <code>denied<\/code> and <code>unauthorized<\/code> errors.<\/li>\n<li><strong>Federated username format:<\/strong> For SSO\/federated identities, Docker username format can differ. Verify in official docs.<\/li>\n<li><strong>Mutable tags:<\/strong> Tags can be overwritten; use digests for immutable references.<\/li>\n<li><strong>Private subnet egress:<\/strong> OKE\/Compute in private subnets must have outbound connectivity to the registry endpoint. If you assume Service Gateway works for all services, you may be surprised\u2014verify.<\/li>\n<li><strong>Large image performance:<\/strong> Very large images slow deployments and inflate costs.<\/li>\n<li><strong>Audit coverage:<\/strong> Control-plane operations are typically audited; full data-plane pull\/push logging may not meet strict forensics requirements without additional tooling (verify).<\/li>\n<li><strong>Cleanup complexity:<\/strong> Deleting tags\/images may have rules; ensure you understand whether deleting a tag deletes the underlying manifest\/layers or just the reference (verify behavior in docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Repository count, artifact count, and storage quotas can apply.<\/li>\n<li>Check OCI Console <strong>Limits, Quotas and Usage<\/strong> and Artifact Registry limits documentation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Image naming changes (endpoint + namespace paths) require updates to deployment manifests.<\/li>\n<li>Re-tagging strategies and CI scripts must be updated.<\/li>\n<li>Access control differences vs. other registries require careful review.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in Oracle Cloud<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Object Storage<\/strong>: Can store files, but is not a Docker registry; lacks native container push\/pull semantics.<\/li>\n<li><strong>OCI DevOps Artifacts\/Deploy artifacts<\/strong>: DevOps pipelines may reference artifacts stored in different backends; Artifact Registry is purpose-built for container distribution.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nearest services in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Elastic Container Registry (ECR)<\/strong><\/li>\n<li><strong>Google Artifact Registry<\/strong><\/li>\n<li><strong>Azure Container Registry (ACR)<\/strong><\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source \/ self-managed alternatives<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Harbor<\/strong> (popular enterprise registry)<\/li>\n<li><strong>JFrog Artifactory<\/strong><\/li>\n<li><strong>Sonatype Nexus Repository<\/strong><\/li>\n<li><strong>Docker Registry<\/strong> (open-source registry server)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Comparison table<\/h4>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>OCI Artifact Registry<\/strong><\/td>\n<td>OCI-native container delivery<\/td>\n<td>IAM + compartments, OCI integration, regional proximity to OCI Compute\/OKE<\/td>\n<td>Feature parity vs specialized registries depends on region\/roadmap; cross-cloud patterns may require extra work<\/td>\n<td>Your runtime is on Oracle Cloud and you want OCI-native governance<\/td>\n<\/tr>\n<tr>\n<td>OCI Object Storage<\/td>\n<td>Generic file storage<\/td>\n<td>Durable object storage, lifecycle policies<\/td>\n<td>Not a container registry; no native docker push\/pull<\/td>\n<td>Store non-registry artifacts or backups\/exports<\/td>\n<\/tr>\n<tr>\n<td>AWS ECR<\/td>\n<td>AWS workloads<\/td>\n<td>Deep AWS integration, mature ecosystem<\/td>\n<td>Cross-cloud pulls can incur complexity\/cost<\/td>\n<td>Your runtime is on AWS<\/td>\n<\/tr>\n<tr>\n<td>Google Artifact Registry<\/td>\n<td>GCP workloads<\/td>\n<td>Strong integration with GKE\/Cloud Build<\/td>\n<td>Not OCI-native<\/td>\n<td>Your runtime is on GCP<\/td>\n<\/tr>\n<tr>\n<td>Azure ACR<\/td>\n<td>Azure workloads<\/td>\n<td>Tight AKS\/Azure DevOps integration<\/td>\n<td>Not OCI-native<\/td>\n<td>Your runtime is on Azure<\/td>\n<\/tr>\n<tr>\n<td>Harbor (self-managed)<\/td>\n<td>Enterprise control, on-prem\/hybrid<\/td>\n<td>Rich policy controls, can run anywhere<\/td>\n<td>You operate and secure it; upgrades, storage, HA<\/td>\n<td>You need on-prem\/hybrid registry or custom controls<\/td>\n<\/tr>\n<tr>\n<td>JFrog Artifactory<\/td>\n<td>Large enterprises, multi-format<\/td>\n<td>Broad artifact formats, enterprise workflows<\/td>\n<td>Cost and operational complexity<\/td>\n<td>You need one repo manager for many artifact types across clouds<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated financial services on OCI + OKE<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> The organization runs microservices on OKE with strict separation between dev\/test\/prod and strong audit requirements. They want to prevent developers from pushing directly to production images.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Artifact Registry repositories separated by compartment: <code>dev<\/code>, <code>test<\/code>, <code>prod<\/code><\/li>\n<li>OCI DevOps build pipeline pushes to <code>dev<\/code> repository<\/li>\n<li>Promotion pipeline retags or copies approved images into <code>prod<\/code> repository (exact mechanism depends on supported operations\u2014verify)<\/li>\n<li>OKE production nodes only have pull access to <code>prod<\/code><\/li>\n<li>OCI Audit enabled for control-plane operations<\/li>\n<li>Auth tokens stored in OCI Vault for CI use<\/li>\n<li><strong>Why Artifact Registry was chosen:<\/strong> OCI-native IAM and compartments align with enterprise governance and reduce the overhead of maintaining a self-hosted registry.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Clear separation of duties (developers build; release engineering promotes)<\/li>\n<li>Faster and more reliable deployments due to regional proximity<\/li>\n<li>Improved traceability via standardized tags and controlled promotion<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: single VM + lightweight containers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A small team deploys two containerized services to OCI Compute VMs. They want a simple, private place to store images without running their own registry server.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>One Artifact Registry repository per service<\/li>\n<li>GitHub Actions (or OCI DevOps) builds and pushes images on each release<\/li>\n<li>VM pulls images during deployment using a scoped auth token<\/li>\n<li><strong>Why Artifact Registry was chosen:<\/strong> Minimal operational burden and straightforward Docker compatibility.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Repeatable deployments and quick rollback to prior tags<\/li>\n<li>Reduced risk from pulling directly from public registries<\/li>\n<li>Clean path to migrate to OKE later without changing the artifact source<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Artifact Registry the same as OCIR (OCI Registry)?<\/strong><br\/>\nArtifact Registry is the current service name in OCI for registry capabilities, and many endpoints\/workflows still reference <code>ocir.io<\/code>. Older documentation may use \u201cOCIR.\u201d Confirm current terminology and capabilities in the official docs.<\/p>\n\n\n\n<p>2) <strong>Is Artifact Registry global or regional?<\/strong><br\/>\nArtifact registries are typically <strong>regional<\/strong> in OCI. Create repositories in the region where you deploy Compute\/OKE for best performance. Verify any cross-region options in official docs.<\/p>\n\n\n\n<p>3) <strong>What can I store in Artifact Registry?<\/strong><br\/>\nMost commonly <strong>container images<\/strong>. Other artifact formats (for example Helm charts or generic artifacts) may be supported\u2014verify supported formats in the official documentation for your tenancy\/region.<\/p>\n\n\n\n<p>4) <strong>How do I authenticate Docker to OCI Artifact Registry?<\/strong><br\/>\nCommonly via <code>docker login REGIONKEY.ocir.io<\/code> using <code>NAMESPACE\/USERNAME<\/code> and an <strong>auth token<\/strong> as the password. Username formats can differ for federated identities\u2014verify.<\/p>\n\n\n\n<p>5) <strong>Should I use my OCI console password for Docker login?<\/strong><br\/>\nTypically no. OCI commonly recommends <strong>auth tokens<\/strong> for registry access. Follow the official Artifact Registry authentication guide.<\/p>\n\n\n\n<p>6) <strong>How should I name repositories?<\/strong><br\/>\nUse a consistent convention: per team, per app, or per environment. Example: <code>team-service<\/code>, and enforce it with governance.<\/p>\n\n\n\n<p>7) <strong>Should I deploy using image tags or digests?<\/strong><br\/>\nUse <strong>digests<\/strong> for strict immutability in production where possible. Use tags for human readability and promotion flows.<\/p>\n\n\n\n<p>8) <strong>Can OKE pull images from Artifact Registry automatically?<\/strong><br\/>\nOKE can pull images from OCI registry endpoints, but authentication method depends on cluster\/node setup and repository visibility. Configure imagePullSecrets where required.<\/p>\n\n\n\n<p>9) <strong>Does Artifact Registry support vulnerability scanning?<\/strong><br\/>\nOCI has security services that can scan container images in registries, but the exact integration and coverage should be confirmed in current official docs for your region and service versions.<\/p>\n\n\n\n<p>10) <strong>How do I keep costs down?<\/strong><br\/>\nReduce image size, delete old tags, avoid storing every CI build forever, and keep pulls in-region.<\/p>\n\n\n\n<p>11) <strong>Why do I get <code>denied: requested access<\/code> when pushing?<\/strong><br\/>\nUsually wrong repo path, wrong namespace, or missing IAM permission. Confirm the repo exists in the selected compartment and your policy allows pushing.<\/p>\n\n\n\n<p>12) <strong>Why do pulls work on my laptop but not from a private VM?<\/strong><br\/>\nPrivate subnets need outbound HTTPS access. Ensure NAT\/equivalent egress routing and DNS are correct.<\/p>\n\n\n\n<p>13) <strong>Can I use Artifact Registry for non-container artifacts?<\/strong><br\/>\nPossibly, depending on what artifact formats OCI supports in Artifact Registry at the time. Verify official docs for supported repository formats.<\/p>\n\n\n\n<p>14) <strong>How do I implement dev\/test\/prod separation?<\/strong><br\/>\nUse separate compartments and separate repositories, then lock down prod push rights to a release automation identity.<\/p>\n\n\n\n<p>15) <strong>What\u2019s the best way to rotate registry credentials?<\/strong><br\/>\nUse dedicated tokens for CI and for runtime, store them in Vault\/secret manager, rotate on a schedule, and revoke immediately on suspected compromise.<\/p>\n\n\n\n<p>16) <strong>What happens when I delete a tag?<\/strong><br\/>\nBehavior differs between registry implementations. It may remove only the tag reference or mark artifacts for garbage collection. Verify OCI\u2019s deletion semantics before building cleanup automation.<\/p>\n\n\n\n<p>17) <strong>Do I need OCI CLI to use Artifact Registry?<\/strong><br\/>\nNo. You can do everything with Console + Docker. CLI\/API become useful for automation and repeatability.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Artifact Registry<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Artifact Registry \/ Registry docs: https:\/\/docs.oracle.com\/en-us\/iaas\/<\/td>\n<td>Authoritative reference for repositories, auth, endpoints, limits<\/td>\n<\/tr>\n<tr>\n<td>Official service docs (common path used historically)<\/td>\n<td>OCI Registry documentation (may include Artifact Registry content): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Registry\/home.htm<\/td>\n<td>Many workflows still reference OCIR endpoints and Docker usage<\/td>\n<\/tr>\n<tr>\n<td>Official IAM docs<\/td>\n<td>OCI IAM Overview: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<td>Understand policies, groups, dynamic groups, auth concepts<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Price List: https:\/\/www.oracle.com\/cloud\/price-list\/<\/td>\n<td>Confirm current pricing dimensions for storage and egress<\/td>\n<\/tr>\n<tr>\n<td>Official cost tool<\/td>\n<td>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<td>Build region-specific cost estimates without guessing numbers<\/td>\n<\/tr>\n<tr>\n<td>Official Compute docs<\/td>\n<td>OCI Compute docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Compute\/home.htm<\/td>\n<td>VM setup for running\/pulling container images<\/td>\n<\/tr>\n<tr>\n<td>Official OKE docs<\/td>\n<td>OCI Container Engine for Kubernetes: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/ContEng\/home.htm<\/td>\n<td>Kubernetes image pull patterns and cluster architecture<\/td>\n<\/tr>\n<tr>\n<td>Official DevOps docs<\/td>\n<td>OCI DevOps: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/devops\/using\/home.htm<\/td>\n<td>CI\/CD integration patterns with registries<\/td>\n<\/tr>\n<tr>\n<td>Official security\/audit docs<\/td>\n<td>OCI Audit: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm<\/td>\n<td>Governance and visibility into registry management operations<\/td>\n<\/tr>\n<tr>\n<td>Trusted community<\/td>\n<td>Oracle Cloud Infrastructure blog: https:\/\/blogs.oracle.com\/cloud-infrastructure\/<\/td>\n<td>Practical announcements and implementation guidance (validate against docs)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>CI\/CD, containers, cloud DevOps practices (verify OCI coverage)<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate DevOps learners<\/td>\n<td>SCM, DevOps tooling, foundational practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud ops, monitoring, automation, operations practices<\/td>\n<td>Check website<\/td>\n<td>https:\/\/cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, reliability engineers<\/td>\n<td>SRE principles, incident response, observability<\/td>\n<td>Check website<\/td>\n<td>https:\/\/sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops teams adopting AIOps<\/td>\n<td>AIOps concepts, automation, event correlation<\/td>\n<td>Check website<\/td>\n<td>https:\/\/aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training content (verify offerings)<\/td>\n<td>Engineers seeking guided training<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training services (verify OCI coverage)<\/td>\n<td>DevOps beginners to advanced<\/td>\n<td>https:\/\/devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps help\/training (verify scope)<\/td>\n<td>Teams needing short-term expertise<\/td>\n<td>https:\/\/devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and guidance (verify services)<\/td>\n<td>Ops teams needing practical help<\/td>\n<td>https:\/\/devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify portfolio)<\/td>\n<td>Architecture, migrations, CI\/CD, ops<\/td>\n<td>OCI container platform setup, registry governance model, pipeline hardening<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps consulting and enablement<\/td>\n<td>Training + delivery support<\/td>\n<td>Build-to-deploy pipelines using Artifact Registry, OKE deployment patterns, IAM best practices<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify services)<\/td>\n<td>DevOps transformation and automation<\/td>\n<td>Container standardization, secret management, rollout strategies<\/td>\n<td>https:\/\/devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Docker fundamentals: images, layers, tags, registries<\/li>\n<li>Basic OCI concepts: compartments, VCNs, IAM users\/groups\/policies<\/li>\n<li>Compute basics: VM provisioning, SSH, firewall\/security lists<\/li>\n<li>CI fundamentals: build\/test\/publish steps<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after this service<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI DevOps pipelines (build and deploy)<\/li>\n<li>OKE (Kubernetes) production operations<\/li>\n<li>Secrets management with OCI Vault<\/li>\n<li>Supply chain security: digest pinning, provenance, signing (depending on toolchain support)<\/li>\n<li>Observability: logging\/metrics for deployment pipelines and runtime<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DevOps Engineer<\/li>\n<li>Site Reliability Engineer (SRE)<\/li>\n<li>Cloud Engineer (Oracle Cloud)<\/li>\n<li>Platform Engineer<\/li>\n<li>Kubernetes Administrator\/Engineer<\/li>\n<li>Security Engineer (cloud application security)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle\u2019s certification offerings change over time. Look for:\n&#8211; OCI Architect\/Developer\/DevOps-related certifications on Oracle University (verify current certification titles and whether Artifact Registry is covered).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a CI pipeline that pushes versioned images to Artifact Registry and deploys to a Compute VM.<\/li>\n<li>Create an OKE deployment that pulls from a private repo using imagePullSecrets.<\/li>\n<li>Implement an image retention cleanup script using OCI CLI\/API (verify supported endpoints).<\/li>\n<li>Design dev\/test\/prod compartment separation with least-privilege IAM policies.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Artifact<\/strong>: A build output used for deployment (container image, chart, package).<\/li>\n<li><strong>Artifact Registry<\/strong>: OCI managed service for storing\/distributing artifacts (commonly container images).<\/li>\n<li><strong>OCIR<\/strong>: OCI Registry; legacy\/older naming often still used in endpoints (<code>ocir.io<\/code>).<\/li>\n<li><strong>Compartment<\/strong>: OCI logical container for resources and IAM access boundaries.<\/li>\n<li><strong>Tenancy namespace<\/strong>: Unique identifier used in OCI registry image names.<\/li>\n<li><strong>Repository (repo)<\/strong>: A named collection of artifacts\/images.<\/li>\n<li><strong>Tag<\/strong>: Human-readable label for an image version (<code>:1.0.0<\/code>, <code>:prod<\/code>).<\/li>\n<li><strong>Digest<\/strong>: Immutable cryptographic identifier for a specific image (<code>@sha256:...<\/code>).<\/li>\n<li><strong>Auth token<\/strong>: Token used as a password for registry authentication.<\/li>\n<li><strong>OKE<\/strong>: Oracle Container Engine for Kubernetes.<\/li>\n<li><strong>Egress<\/strong>: Outbound network traffic from a VCN\/subnet to a service endpoint.<\/li>\n<li><strong>NAT gateway<\/strong>: OCI networking component enabling outbound internet access for private subnets.<\/li>\n<li><strong>Least privilege<\/strong>: Grant only the permissions required to perform a task.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Artifact Registry<\/strong> is OCI\u2019s managed registry service for storing and distributing artifacts\u2014most commonly <strong>container images<\/strong> that are pulled and run by <strong>Compute<\/strong> instances and <strong>OKE<\/strong> clusters. It matters because reliable artifact storage is a prerequisite for consistent CI\/CD, safe rollouts, and scalable operations.<\/p>\n\n\n\n<p>Architecturally, treat Artifact Registry as a regional dependency for your deployments: keep artifacts close to runtime, separate environments by compartments, and deploy production by digest when possible. Cost is primarily driven by stored GB-month and image pull\/egress patterns\u2014so reduce image size, control retention, and avoid unnecessary cross-region pulls. Security hinges on IAM: lock down push access to production repositories, protect auth tokens, and use audit logs for governance.<\/p>\n\n\n\n<p>Next step: integrate Artifact Registry with an OCI DevOps build\/deploy pipeline or an OKE cluster pull workflow, and formalize your tag\/digest promotion strategy.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Compute<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,62],"tags":[],"class_list":["post-865","post","type-post","status-publish","format-standard","hentry","category-compute","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=865"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/865\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}